An unusual partnership between the American Civil Liberties Union and the Tenth Amendment Center is pushing states to adopt model legislation that the organizations argue will fill in gaps in student-data-privacy protections.
Proposed overhauls of digital-privacy laws, including many that regulate relationships between ed-tech vendors and school districts, were simultaneously introduced in 16 states and the District of Columbia last month in bills based on the model legislation.
Though the ACLU, with headquarters in New York City, and the Los-Angeles based Tenth Amendment Center are generally seen as being on opposite ends of the ideological spectrum, they have found common ground in their advocacy for stronger electronic-privacy protections.
In consultation with the center—a think tank that advocates strict limits on federal power—the ACLU wrote model legislation that both organizations are urging legislators around the country to support.
Chad Marlow, the ACLU advocacy and policy counsel, said that the parts of the bills aimed at bolstering student-privacy protections were written to ensure that “schools don’t become a Constitution-free zone,” and that companies that want to collect student data must first get explicit permission.
Over the past two years, 32 states have enacted some sort of data-privacy law, according to the Data Quality Campaign. Some of those laws have been sweeping, such as California’s Student Online Personal Information Privacy Act, which has drawn particular praise from privacy advocates. Other laws are much weaker, experts say.
To work around a lack of movement at the federal level over data-privacy protections for students, the activists and lawmakers working with the two organizations are calculating that if they get enough states to adopt a stricter slate of privacy expectations for vendors, companies will have little choice but to raise their standards to a level nationally that would allow them to work in any state.
The ACLU has outlined four main areas for states to focus on when crafting data-privacy legislation, including:
Student Information Systems Privacy
Requiring specific permission from parents before student data are used for noneducational purposes by a third party.
1-to-1 Device Privacy
Placing limits on the ability of schools and third parties to access information about student behavior or communications that are made on computing devices loaned to students.
Student Personal Technology on Campus
Ensuring that the same legal protections that apply to students’ personal electronic devices away from school also apply when students are on campus.
Student Social Media Privacy
Barring educational institutions from demanding access to students’ social-media accounts, with few exceptions.
Source: ACLU and Tenth Amendment Center
“It would be impractical for Google to have 50 different privacy standards,” said Anthony Romero, the executive director of the ACLU, during an audio press conference.
Menu of Provisions
The model bill crafted by the ACLU is meant to serve as a menu of data-privacy provisions from which other groups and state lawmakers can pick and choose—meaning that each state bill can be somewhat different.
Many of the bills have a broad focus that aims to improve data-privacy protections across society, not just in schools. However, in states where the ACLU and the Tenth Amendment Center believe that existing student-data protections are weak, the proposed legislation focuses on stepping up safeguards in four specific areas:
- Parental or student consent to release student data for noneducational purposes or to third parties;
- Limits on information that can be gleaned from computing devices loaned to students;
- Protections from warrantless searches of students on campus; and
- Restrictions on access to student postings that are behind privacy settings on social-media.
The model legislation also calls for professional development to help teachers familiarize themselves with basic student-data-privacy concepts.
Student-data protection is of special interest to the ACLU because the group holds that K-12 students are “extremely vulnerable to being aggressively targeted” by companies seeking such information to build personalized marketing profiles, Marlow said.
He also echoed other experts who are concerned about certain scenarios in which students might feel inappropriately pressured to waive their privacy rights or risk being barred from participating in classroom activities that require use of ed-tech tools that aim to personalize learning.
Marlow pointed to the controversial practices of the now-shuttered nonprofit InBloom as indicative of another type of behavior his group is trying to combat. InBloom drew withering fire from critics upset about the amount of student information it planned to collect and share with third parties.
The Future of Privacy Forum—a Washington-based think tank and a co-author of the Student Privacy Pledge, a commitment by ed-tech companies to safeguard data—offered a measured endorsement of the provisions in the ACLU’s model bill.
The forum applauded the model legislation’s language on parental-release mechanisms and its calls for teacher professional development on basic data-privacy issues, but is worried that an overly strict definition of “personally identifiable information” and the risk of personallegal liability for teachers who make mistakes could undermine both the ed-tech industry and the work of classroom educators.
Critiquing Two State Bills
Steven Hodas, an education innovation “cluster leader” at Digital Promise, a nonprofit group that seeks to improve schools through research and technology, said the language in some of the bills might balance the interests of students with the operational needs of schools and vendors better than others.
Some of the state proposals, like Alabama’s, appear to be less concerned with the prospect of student data falling into the hands of advertisers than with a school’s right to collect such information in the first place, said Hodas, who emphasized that his views on data privacy were his own and did not necessarily reflect the organizational positions of Digital Promise.
Hodas interpreted another section of the Alabama bill, which would prohibit schools or officials from administering student surveys on “psychological resources, mindsets, effortful control, attributes, dispositions, social skills, attitudes, or intrapersonal resources” as potentially interfering with some schools’ burgeoning interest in collecting information on student qualities such as perseverance or “grit.”
Another part of the Alabama legislation says that “no student data shall be used for predictive modeling for detecting behaviors, beliefs, or value systems, or predicting or forecasting student outcomes.” That language could, in theory, hamper the ability of an ed-tech company to use data to customize classroom learning, said Hodas.
Instead of “wishing away an entire category of knowing” about education, Hodas said, states would be better served by allowing companies to collect some essential data and then enacting strict punishments for instances of its misuse. He said the ACLU-backed bill proposed in Nebraska “is more familiar with how schools actually work.”
The bill includes broader exceptions for vendors who want to use student data to improve their products.
The variations between some of the proposed pieces of legislation reflect the unusual coalitions behind some of the efforts.
The Alabama bill, in particular, was the product of a reconciliation between the ACLU’s proposal and one by the Eagle Forum of Alabama, a Birmingham-based nonprofit that promotes conservative causes. Deborah Love, the group’s executive director, said it was “sad” that people are surprised that there is such broad bipartisan support for initiatives that “ensure that liberty is respected in our houses of learning.”
While the ACLU and the Eagle Forum have their philosophical differences, both Marlow and Love said they do not expect the proposed law in Alabama—or, in Marlow’s contention, any of the bills nationally—to hurt ed-tech companies that are already acting ethically.
The overriding goal of the legislation, according to Marlow, “is to empower parents and kids to make informed choices about what they do or don’t want to share.”
A version of this article appeared in the February 10, 2016 edition of Education Week as Partnership Boosts Data Privacy